[finding][drivers] 27 dead `{ bypassTenantAudit: true } as any` options-gate casts in driver-sql / driver-sqlite-wasm tests — unlike turso's, these sit on a REAL typed gate

[os-zhuang]

Measured during #6394 (removing the single as never on date-bucket-parity.test.ts's driver.create options gate). The dispatch for #6394 asked for a same-shape scan of other drivers' test options-gate casts as read-only — this is that scan's result, filed rather than fixed. Observation-class, no pm:queue, please grade in a triage round.

The inventory

Same shape as #6394's cast, spelled as any instead of as never, on driver.create(…) / driver.find(…) options arguments in test files:

Package	Sites
driver-sqlite-wasm	17
driver-sql	10
Total	27 across 12 files

(driver-turso has 2 more, in turso-temporal-conformance.test.ts — see the split below for why they are a different animal.)

Reproduce the inventory:

grep -rnE "\{ *bypassTenantAudit: true *\} as (any|never)" packages/drivers/*/src --include=*.test.ts

Measured: all 27 are dead

Baseline origin/main @ 64d764e, dependency closures built first so the verdict is not read off stale dist/*.d.ts. Stripped all 27 casts, then:

@objectstack/driver-sql        typecheck → EXIT=0
@objectstack/driver-sqlite-wasm typecheck → EXIT=0

Zero output both. bypassTenantAudit is a declared key on DriverOptionsSchema (packages/spec/src/data/driver.zod.ts:99), so no cast was ever needed — identical to #6394's finding on the as never.

Why this is worth more than #6394 was

These 27 sit on a genuinely typed gate, and #6394's does not. That is the whole point of filing it separately.

SqlDriver.create declares options?: DriverOptions (packages/drivers/driver-sql/src/sql-driver.ts:2961), and SqliteWasmDriver does not override it, so both inherit real checking. Removing a cast there restores it — measured, by misspelling one key after the strip:

src/sql-driver-runtime-token-default.test.ts(111,73): error TS2561: Object literal may only
specify known properties, but 'bypassTenantAuditt' does not exist in type '{ transaction?:
unknown; timeout?: number | undefined; … bypassTenantAudit?: boolean | undefined; }'.
Did you mean to write 'bypassTenantAudit'?

TursoDriver, by contrast, overrides create with options?: any (see #6402 and my comment there), so at #6394's call site the same typo compiles clean with or without the cast. That is why #6394 was correctly graded a noise removal with no restored check, and why these 27 are not the same trade.

So the ordering matters: fixing these 27 buys real compile-time checking today, whereas the turso family (#6402) has to narrow options?: any first before its casts are worth touching.

Not a defect

No known bug has come out of this. Every affected suite is green; the cost is dormant — a misspelled or wrong-typed options key in these 27 test call sites goes unreported. Nobody has tripped on it.

If it gets done

Mechanical: delete as any at the 27 sites, then pnpm --filter @objectstack/driver-sql typecheck and pnpm --filter @objectstack/driver-sqlite-wasm typecheck. Both were measured green with the casts already gone, so the change is expected to be zero-error. Tests-only, no changeset.

Worth doing in one pass across both packages rather than piecemeal, for the reason #6402 gives about its own five: a partial fix reads to the next reader as a judgment about the sites left behind.

Related

• [finding][drivers] driver-turso 的 date-bucket-parity 测试里还有一处死 as never —— 在 driver.create 的 options 门上，与 #6354 不同门 #6394 — the single as never, same shape, different gate (turso's options?: any); this scan came out of its dispatch
• [finding][drivers] TursoDriver 五个 override 的 options?: any —— #5181 收窄的是 query，options 这条轴还没人碰过 #6402 — TursoDriver's options?: any overrides, the reason turso's casts are a separate problem
• [finding][drivers] DriverQuery 收窄之外：aggregate / distinct / analyzeQuery 等驱动自有查询方法仍要求把对象名写两遍 #6212 — same family (declared-but-unread shapes)

[os-zhuang]

Measured from #6402's PR (#6755), which narrows the options?: any this issue names as the turso blocker — the blocker is cleared, and the turso split now measures the same way driver-sql does.

Two things worth recording here, both measured on top of #6755:

1. The turso count is 3, not 2. date-bucket-parity.test.ts:68 carries the as never (that is #6394's site) and turso-temporal-conformance.test.ts:114,156 carry the two as any. Same inventory grep, run against origin/main @ 64d764e + #6755:

packages/drivers/driver-turso/src/date-bucket-parity.test.ts:68:          { bypassTenantAudit: true } as never,
packages/drivers/driver-turso/src/turso-temporal-conformance.test.ts:114:        { bypassTenantAudit: true } as any,
packages/drivers/driver-turso/src/turso-temporal-conformance.test.ts:156:        { bypassTenantAudit: true } as any,

2. All 3 are dead once options is narrowed, and removing them restores real checking. Stripped all three:

@objectstack/driver-turso typecheck → EXIT=0

Then misspelled one key after the strip, which is the check that matters — this is the measurement that was impossible before #6402:

src/turso-temporal-conformance.test.ts(114,11): error TS2561: Object literal may only specify
known properties, but 'bypassTenantAuditt' does not exist in type '{ transaction?: unknown;
timeout?: number | undefined; skipCache?: boolean | undefined; traceContext?: Record<string,
string> | undefined; tenantId?: string | undefined; tenantIds?: string[] | undefined;
timezone?: string | undefined; preserveAudit?: boolean | undefined; bypassTenantAudit?:
boolean | undefined; }'. Did you mean to write 'bypassTenantAudit'?

Character-for-character the same class of error this issue quotes from sql-driver-runtime-token-default.test.ts. So after #6755 lands, the turso 3 stop being "a different animal" and join the same trade as the 27: deleting the cast buys back a real compile-time check.

That also revises this issue's ordering note. It says the turso family "has to narrow options?: any first before its casts are worth touching" — correct at filing time, and #6755 is that narrowing. Whoever picks this up can fold the turso 3 into the same pass for a total of 30 across 3 packages, or leave them to #6394; either way the reason for holding them separate is gone. Worth deciding deliberately rather than by default, since this issue's own closing argument is that a partial fix reads as a judgment about the sites left behind.

⚠️ Deliberately not fixed in #6755 — that PR's diff is held to 3 files (the driver, its pin test, the changeset) because the casts are claimed by this issue and #6394, and quietly absorbing them would leave both stale. Recording the measurement instead so it does not have to be re-derived.

One correction to the framing above, for accuracy: #6402 itself names five overrides; measured against main it is 17, so #6755 narrows all 17 rather than the five. Does not change anything for this issue — the gate on create / find is real either way — but the cross-reference in this issue's body points at the five-count.

---

Generated by Claude Code

[os-zhuang]

Triage: finding added (domain:drivers was already in place; the card had routing but no pm-state, making it invisible to the queue view).

• Classification: observation-class, per the card's own request and the step-0 criterion — 27 dead as any casts in test files, every suite green, nobody hit anything; the cost is dormant (typos in options keys at those 27 sites go unreported). Held for a findings-triage round to grade, not queued today.
• Grading note for that round (recorded now so it isn't re-derived): the case for promotion is stronger than a cosmetic sweep — the body measured that stripping the casts restores real compile-time checking (TS2561 on a misspelled key) because SqlDriver.create declares options?: DriverOptions, unlike the turso family ([finding][drivers] TursoDriver 五个 override 的 options?: any —— #5181 收窄的是 query，options 这条轴还没人碰过 #6402) which must narrow options?: any first. Mechanical, tests-only, no changeset, both typechecks measured green post-strip. Also note the maintainer's 2026-08-05 investment-freeze anchor on the driver-memory/driver-mongodb families does NOT cover this card — the sites are driver-sql/driver-sqlite-wasm.
• Anchor verification: inventory grep and the fix(driver-turso): narrow every override's options from any to DriverOptions (#6402) #6755-adjacent turso split are recorded in the body and the 14:23Z comment; premise is fresh (filed today against 64d764e, and origin/main has had no driver-sql/driver-sqlite-wasm test-file cast changes since — the fix(driver-turso): narrow every override's options from any to DriverOptions (#6402) #6755 PR touches turso only).
• Dedup: [finding][drivers] driver-turso 的 date-bucket-parity 测试里还有一处死 as never —— 在 driver.create 的 options 门上，与 #6354 不同门 #6394 (the single as never, done), [finding][drivers] TursoDriver 五个 override 的 options?: any —— #5181 收窄的是 query，options 这条轴还没人碰过 #6402 (turso options?: any narrowing, in flight via PR fix(driver-turso): narrow every override's options from any to DriverOptions (#6402) #6755) — disjoint by the split this card itself documents. Clean.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Findings-round grading: promoted — finding → pm:queue (domain:drivers kept).

Basis (recorded 14:31Z, confirmed now): stripping the 27 casts restores real compile-time checking (measured TS2561 on a misspelled key) because SqlDriver.create declares options?: DriverOptions — restore-invariant class, mechanical, tests-only. Stale-premise re-check at origin/main @ 9b86cf6: the inventory grep still hits the same driver-sql/driver-sqlite-wasm test files (10 files sampled, counts consistent with the card's 27). The maintainer's 2026-08-05 investment freeze covers driver-memory/driver-mongodb, not these packages. The turso 3-site split stays with #6402/PR #6755 per the 14:23Z comment — disjoint scopes.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop, drivers lane — dispatched under the maintainer's standing authorization of 2026-08-08 ~17:15Z (「6577 落地后继续按序派发,不用等我确认」).

Session: session_01Hg9Pkg5nDedCRihRsdeCdX
Branch: claude/issue-6754-bypass-tenant-audit-dead-casts
Worktree: objectstack-issue-6754 (cloud session — own container, Opus)

On the v17 priority. The maintainer's 2026-08-09 ~03:07Z instruction puts target:v17 first in this lane. Censused at 05:35Z across all 46 open target:v17-or-domain:drivers issues (the label filter is OR, so intersected by hand): the only card carrying both was #5495, which merged minutes ago as 7d1ff752b. This lane's v17 board is therefore empty, and falling back to queue order is a deliberate call rather than a silent drift — recorded here so it can be overruled.

Serial constraint cleared. PR #6932 (#5495) merged; no open PR touches driver-sql/driver-sqlite-wasm test files. The #6792 file-surface conflict that blocked this card earlier today expired when PR #6908 merged.

Inventory re-measured on main @ 7d1ff752b — the card's 27 is three revisions stale

Package	casts	files
driver-sql	11	6
driver-sqlite-wasm	18	8
in-scope total	29	14
driver-turso	4	2
driver-memory / driver-mongodb	0	0

It is still growing: I measured 29 at ~01:00Z, 33 at 05:38Z and 35 (incl. non-drivers sites) at 06:00Z. Re-count at the start of the work rather than trusting any number written here.

driver-memory/driver-mongodb hold zero sites, so the #5499 freeze is not implicated at all — not "avoided", genuinely absent.

A decision that has changed since the thread last discussed it

The 14:23Z comment offers two options for the turso 3 (now 4): fold them into this pass, or leave them to #6394 — "worth deciding deliberately rather than by default". The second option no longer exists. #6394 has landed: as never survivors on current main measure zero, and #6402/PR #6755 merged today, so the options?: any narrowing that was turso's blocker is done. Either this card takes the turso 4, or nobody does. That is the single decision this dispatch asks to be made on evidence, not taste — and the card's own closing argument (a partial fix reads as a judgment about the sites left behind) now points at folding them in.

⚠️ A trap the card does not name

A repo-wide grep also hits packages/objectql/src/engine-unknown-option.test.ts (2 casts). Those are load-bearing and out of lane — different package, different shape: the cast sits on the query object handed to engine.find(...), in a file whose entire purpose is exercising the engine's unknown-option handling, and the key appears in that file's own PASSTHROUGH drift pin. Stripping it would delete the test's subject. ⛔ Out of scope; a naive repo-wide strip breaks it.

The acceptance bar is already established on this thread

Removing the casts must restore real checking, not merely typecheck green: the 14:23Z measurement misspelled a key after the strip and got TS2561 … Did you mean to write 'bypassTenantAudit'?. That is the evidence required per package touched — green alone is the failure mode this card exists to fix.

---

Generated by Claude Code